• Light/Dark
  • Ever wanted an RSS feed of all your favorite gaming news sites? Go check out our new Gaming Headlines feed! Read more about it here.
  • We have made minor adjustments to how the search bar works on ResetEra. You can read about the changes here.

PSA: Zoom is not secure, leaking emails, and other issues

Reader mode
AMAGON

AMAGON

Prominent Member
Member
Oct 25, 2017
6,956
Austin, TX
Octodad said:
I think it would be hard to get my work teams on Discord frankly.
Click to expand...
Click to shrink...
Looking for a solution as well, especially one that we can cater towards to our clients, (I'm in MSP). Looking to gravitate our business toward businesses WFH now more than ever. I think Teams is the only good secure way to set people up but we do have schools we oversee and so far, they've been using Google for remote learning which I'm navigating the ins and outs of their softwares.
 
BlastProcessing

BlastProcessing

Member
Oct 25, 2017
8,277
The Albatross said:
Zoom has shady privacy agreement and installation methods but that doesn't make it malware, that's a dumb conclusion or misuse of the word "malware"
Click to expand...
Click to shrink...

Secretly spinning up a localhost server that isn't removed on uninstall fits my definition of malware behavior.

medium.com

Zoom Zero Day: 4+ Million Webcams & maybe an RCE? Just get them to visit your website!

Vulnerability in the Mac Zoom Client allows any malicious website to enable your camera without your permission. The flaw potentially…
medium.com medium.com

Additionally, if you've ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install 'feature' continues to work to this day.
Click to expand...
Click to shrink...
 
Windrunner

Windrunner

Sly
Member
Oct 25, 2017
6,500
I hope this gains more traction than all the other times Zoom has been exposed for being shady.

Use a reputable company like Microsoft, Google or Cisco instead of these chancers FFS.
 
Shodan14

Shodan14

Banned
Oct 30, 2017
9,410
Honestly, a lot of the time I'm better of using just normal old fashioned phone calls if video isn't strictly necessary. Especially with clients and for external stuff.
 
Walter White Walker

Walter White Walker

Banned
Oct 27, 2017
21,545
Gundato said:
Almost assuredly nothing to do with security and everything to do with the district having picked a solution and paid for support (or at least "training") for a different solution.
Could also have been zoom's licensing model. For consumers most of these are free. For orgs there are a lot more constraints
Click to expand...
Click to shrink...
They use Canvas. I guess the school district wants to keep everything on that platform.
 
Kthulhu

Kthulhu

Member
Oct 25, 2017
14,670
Discord isn't encrypted either (unless that's changed recently) so if that's important to you it's not a good alternative.

BlastProcessing said:
Secretly spinning up a localhost server that isn't removed on uninstall fits my definition of malware behavior.

medium.com

Zoom Zero Day: 4+ Million Webcams & maybe an RCE? Just get them to visit your website!

Vulnerability in the Mac Zoom Client allows any malicious website to enable your camera without your permission. The flaw potentially…
medium.com medium.com
Click to expand...
Click to shrink...

They stopped doing this after getting caught last year.
 
MrCibb

MrCibb

Member
Dec 12, 2018
5,349
UK
Never used Zoom or barely heard of it before it was everywhere. After reading all this I'm glad it never got pushed to my workplace. I guess our "No webcam" policy stopped that, we've got no use for anything that makes video easier.
 
BlastProcessing

BlastProcessing

Member
Oct 25, 2017
8,277
Kthulhu said:
They stopped doing this after getting caught last year.
Click to expand...
Click to shrink...

That's kinda my point, they have a pattern of playing fast and loose with privacy and only doubling back when they get caught. Even in that situation, which forced Apple to issue an emergency security update, Zoom refused to admit any wrongdoing and referred to their insane scene as a "feature".

There is no way I would every trust or install anything from Zoom on my computer.
 
Richiek

Richiek

Member
Nov 2, 2017
12,063
My company uses Zoom. I informed them of the security risks but they said they will take steps to make it more secure.
 
Meauxse

Meauxse

Member
Oct 25, 2017
4,248
New Orleans, LA
finalflame said:
If you want enterprise grade security, Zoom ain't it. It's a startup, and has all the problems of a small team trying to scale too fast.
Click to expand...
Click to shrink...

I mean, I know DOD and government contractors are using Zoom because of the supposed end to end 256k encryption meets ITAR requirements. They have a government arm as well.

It is 2 magnitudes cheaper per month to use a zoom government service (which requires 25 accounts) than to use any other ITAR compliant video service.
 
HomerSimpson-Man

HomerSimpson-Man

Member
Oct 30, 2017
3,629
Oh wow. Good to know. We have been getting requests to use this at work. Im going to give my desktop support team a heads-up.

Thank you for this.
 
Trup1aya

Trup1aya

Literally a train safety expert
Member
Oct 25, 2017
21,363
Yeah, my work sent an email telling people to stop downloading it to company phones and laptops.

We already have numerous approved video conference clients, and people were using zoom like crazy.
 
OP
OP
captive

captive

Member
Oct 25, 2017
16,999
Houston
Octodad said:
Anyone have a suggestion of a better video chat platform for multiparty usage?
Click to expand...
Click to shrink...
Fuze works pretty well, they have security certifications and HIPPA attestation.

RROCKMAN said:
How is Cisco webex as an alternative? My work uses it and it's been pretty good
Click to expand...
Click to shrink...
webex and teams are what i would reocmmend to enterprises. Webex is solid, been around for a hot minute and should be pretty secure. though i haven't personally verified like i have with Fuze.
 
Last edited:

mrmoose

Member
Nov 13, 2017
21,190
Gundato said:
Almost assuredly nothing to do with security and everything to do with the district having picked a solution and paid for support (or at least "training") for a different solution.
Could also have been zoom's licensing model. For consumers most of these are free. For orgs there are a lot more constraints
Click to expand...
Click to shrink...

I thought zoom released their restrictions on free accounts if you had a district email address and that school district contacted them? So I think it's more the former.

I thought the Mac OS malware stuff was from before, are they still doing that? Also how did someone hack a zoom meeting? Did the coordinator not put a password on it? That seems more like user error. If not and the password was hacked then that's something else.
 
Krakatoa

Krakatoa

Prophet of Regret
Member
Oct 29, 2017
3,092
Am I missing something, as long as you follow their guidelines, then it's secure? It seems that's only open to hacking if you use a public room.
 
Midramble

Midramble

Force of Habit
The Fallen
Oct 25, 2017
10,461
San Francisco
As an IT director I'm getting sick of hearing people suggest zoom. Especially when we already have slack, RingCentral, aaaand GotoMeeting.
 

mrmoose

Member
Nov 13, 2017
21,190
I wouldn't necessarily use Zoom for the workplace. But where it excels is quick conferencing without everyone needing an account, you can just send a link (with password if needed) to a couple dozen people and schedule something. For personal use I'm not sure you need end to end encryption, the convenience trumps that (now if they're recording your meetings, that's something else entirely). For business use where you already have licenses and security constraints, of course there are better alternatives that are blessed by the company security policies.
 
texhnolyze

texhnolyze

Member
Oct 25, 2017
23,175
Indonesia
This article says Zoom has updated their privacy policy twice in the last few days. Does that change anything?

www.consumerreports.org

Zoom Tightens Privacy Policy, Says No User Videos Are Analyzed for Ads

Zoom's privacy policy has been tightened after a Consumer Reports story highlighting concerns. But, as CR explains, there are still some reasons to be cautious when using Zoom.
www.consumerreports.org

Richiek said:
My company uses Zoom. I informed them of the security risks but they said they will take steps to make it more secure.
Click to expand...
Click to shrink...
Same here. At least we use passwords, for one.
 
digitalrelic

digitalrelic

Weight Loss Champion 2018: Biggest Change
Banned
Oct 25, 2017
13,124
I'm IT at a school district and Zoom is garbage. It's easy and has great video quality but it's just not worth all of the endless shady practices and poor security implementations.

We advise against anyone using Zoom in our district.
 
iamdelirium

iamdelirium

Member
Nov 25, 2017
402
E2E encryption can mean different things. It's encrypted from (you) --> Zoom and Zoom --> (others), but no modern video conference can support completely e2e encryption because they have to postprocess your video.

Midramble said:
As an IT director I'm getting sick of hearing people suggest zoom. Especially when we already have slack, RingCentral, aaaand GotoMeeting.
Click to expand...
Click to shrink...
Sorry but RingCentral sucks and so does GoToMeeting. Zoom is by far the best video conference software I've used.
 
Midramble

Midramble

Force of Habit
The Fallen
Oct 25, 2017
10,461
San Francisco
iamdelirium said:
E2E encryption can mean different things. It's encrypted from (you) --> Zoom and Zoom --> (others), but no modern video conference can support completely e2e encryption because they have to postprocess your video.


Sorry but RingCentral sucks and so does GoToMeeting. Zoom is by far the best video conference software I've used.
Click to expand...
Click to shrink...

Goto sucks as well, but what sucks about ringcentral? Two companies I've used it at and love its operation. Outlook integration, e-faxing, great call tree routing, browser or app based meetings. Phone app for virtual phone system. Only things I don't like is that the admin portal layout isn't great and the fact that the phone app and meeting apps are separate apps.
 

mrmoose

Member
Nov 13, 2017
21,190
digitalrelic said:
I'm IT at a school district and Zoom is garbage. It's easy and has great video quality but it's just not worth all of the endless shady practices and poor security implementations.

We advise against anyone using Zoom in our district.
Click to expand...
Click to shrink...

I'm curious what you guys are using to teach kids at home that doesn't require a ton of licenses?
 

Deleted member 1476

User requested account closure
Banned
Oct 25, 2017
10,449
Seems like I dodged a bullet there. I don't think Teams is all that great after using it but I'd take it in a heartbeat over whatever the fuck Zoom is trying to do.
 
Ryan.

Ryan.

Prophet of Truth
The Fallen
Oct 27, 2017
12,889
I'm so confused as to why so much of my university's faculty and staff decide to use Zoom when the school pays for everyone, students included, to have access to WebEx
 
Midramble

Midramble

Force of Habit
The Fallen
Oct 25, 2017
10,461
San Francisco
Ryan. said:
I'm so confused as to why so much of my university's faculty and staff decide to use Zoom when the school pays for everyone, students included, to have access to WebEx
Click to expand...
Click to shrink...

Marketing pushes cause this. Staff get to shadow using apps instead of asking IT what to use because they hear about other people using or get an idea from a marketing campaign. Zoom was smart with this push. Slack should've tried harder our of the gate.
 

Deleted member 388

User Requested Account Deletion
Banned
Oct 25, 2017
1,813
Ryan. said:
I'm so confused as to why so much of my university's faculty and staff decide to use Zoom when the school pays for everyone, students included, to have access to WebEx
Click to expand...
Click to shrink...
Same happened at my job. WebEx and Teams enterprise accounts but everyone wants to use Zoom. It does seem to have far superior video quality and stability. It's just insane that Microsoft, Cisco and Google don't have better servers. Between this and the shady Zoom practices, it's like real life Pied Piper.
 
elenarie

elenarie

Game Developer
Verified
Jun 10, 2018
9,815
Not installing that shit on my personal hardware. :) Only have to use it on the work PC. Would have preferred to stay in the MS ecosystem, but it's not up to me.
 

Deleted member 48897

User requested account closure
Banned
Oct 22, 2018
13,623
I've literally never heard of zoom before this week but it sounds absolutely terrible and I don't understand why it, specifically, managed to catch on so quickly
 
Meauxse

Meauxse

Member
Oct 25, 2017
4,248
New Orleans, LA
I'm super confused about this thread now.

The mac thing was fixed last year.

Articles call out no actual E2E encryption, White paper says it does, no other service supports video E2E...

Security issue is due to people not using passwords and people throwing random numbers in the meeting codes to join random meetings?

Is there a current issue with the platform or not?
 
Rune Walsh

Rune Walsh

Too many boners
Member
Oct 25, 2017
6,032
Luckily my district uses Office 365 and Teams has been pretty great. Call quality is good with zero issues thus far. It's made staff meetings of 70+ people pretty simple to manage.
 

Deleted member 3208

Oct 25, 2017
11,934
Dodged a bullet this weekend when we used for a meeting Discord instead of Zoom.
 
nopressure

nopressure

Member
Oct 28, 2017
1,414
Uhh... This has been rolled out as our "gold standard" of contacting patients in my NHS trust. Guess I'm sticking to private ID phone calls for now.
 

Random Painted Highway

Member
Oct 25, 2017
6,710
The simple fact is that a ton of places were woefully unprepared for this transition and zoom is the fastest easiest and cheapest way to get this moving. Security is compromised in favor of expediency. Yes this is a result of negligence. The chances of someone randomly getting through and access our zooms is quite low.

I have 30ish people in my group ranging from age 25-75. The seniors have no clue how to do anything remotely even when provided laptops. Everything is literally a struggle here so things like this are going to go by the wayside.
 

mrmoose

Member
Nov 13, 2017
21,190
digitalrelic said:
Webex Meetings and/or Microsoft Teams for video conferencing. Yes, there's costs involved, but that's because they aren't selling your data.
Click to expand...
Click to shrink...

So you guys give licenses out to every student? Or do these not need licenses except for the host?

That's where I thought Zoom did a good job, you don't even need an account to join a meeting.
 
Saganator

Saganator

Member
Oct 26, 2017
7,064
One time I clicked on an old Zoom link accidentally and I waltzed right into someone's meeting in progress. It was really strange.
 
Reader mode
You must log in or register to reply here.